Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.
Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.
While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.
Severity: info
Fingerprint: 5733ddf49ff49cd1aad035495633fd2cbb0dcc7ca45d420132f672ffbe3136de
Public Swagger UI/API detected at path: /swagger/index.html - sample paths:
GET /api/account
GET /api/clientauthconfigs/{name}
GET /api/configurations
GET /api/configurations/mobile/zip
GET /api/configurations/{id}
GET /api/configurations/{id}/zip
GET /api/optionscollections/personsincharge
GET /api/optionscollections/usergroup
GET /api/optionscollections/usertype
GET /api/optionscollections/{id}
GET /api/reports
GET /api/version
POST /api/cases/att
Open service 13.69.68.12:443 · y-solopsdemo-slms-sql.syndev.dnv.com
2026-01-23 00:36
HTTP/1.1 200 OK Connection: close Content-Type: text/html Date: Fri, 23 Jan 2026 00:37:11 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Set-Cookie: ARRAffinity=a57f04703cb067b521b92639db8795646b510aebede8c41fcf0de50439a5f66d;Path=/;HttpOnly;Secure;Domain=y-solopsdemo-slms-sql.syndev.dnv.com Set-Cookie: ARRAffinitySameSite=a57f04703cb067b521b92639db8795646b510aebede8c41fcf0de50439a5f66d;Path=/;HttpOnly;SameSite=None;Secure;Domain=y-solopsdemo-slms-sql.syndev.dnv.com Transfer-Encoding: chunked Strict-Transport-Security: max-age=31536000; includeSubDomains Request-Context: appId=cid-v1:10016e79-beb0-44f5-a00e-0c69fbebb04e X-Frame-Options: DENY Referrer-Policy: no-referrer X-Content-Type-Options: nosniff X-Download-Options: noopen X-Robots-Tag: noindex, nofollow Content-Security-Policy: default-src 'none'; script-src 'self' 'report-sample'; style-src 'self' 'report-sample'; img-src 'self'; font-src 'self'; frame-src 'self'; frame-ancestors 'none'; form-action 'none'; object-src 'none'; upgrade-insecure-requests ; base-uri 'none'; report-uri https://y-solopsdemo-slms-sql.syndev.dnv.com/csp-reporting-endpoint; report-to csp-reporting-endpoint; X-Permitted-Cross-Domain-Policies: none permissions-policy: accelerometer=(),autoplay=(),camera=(),display-capture=(),encrypted-media=(),fullscreen=(),gamepad=(),geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),picture-in-picture=(),publickey-credentials-get=(),sync-xhr=(self),usb=(),screen-wake-lock=(),web-share=(),xr-spatial-tracking=() Reporting-Endpoints: csp-reporting-endpoint="https://y-solopsdemo-slms-sql.syndev.dnv.com/csp-reporting-endpoint" Page title: Synergi Life - Mobile Service <html><title>Synergi Life - Mobile Service</title></html>
Open service 13.69.68.12:443 · y-solopsdemo-slms-sql.syndev.dnv.com
2026-01-10 02:15
HTTP/1.1 200 OK Connection: close Content-Type: text/html Date: Sat, 10 Jan 2026 02:16:26 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Set-Cookie: ARRAffinity=a57f04703cb067b521b92639db8795646b510aebede8c41fcf0de50439a5f66d;Path=/;HttpOnly;Secure;Domain=y-solopsdemo-slms-sql.syndev.dnv.com Set-Cookie: ARRAffinitySameSite=a57f04703cb067b521b92639db8795646b510aebede8c41fcf0de50439a5f66d;Path=/;HttpOnly;SameSite=None;Secure;Domain=y-solopsdemo-slms-sql.syndev.dnv.com Transfer-Encoding: chunked Strict-Transport-Security: max-age=31536000; includeSubDomains Request-Context: appId=cid-v1:10016e79-beb0-44f5-a00e-0c69fbebb04e X-Frame-Options: DENY Referrer-Policy: no-referrer X-Content-Type-Options: nosniff X-Download-Options: noopen X-Robots-Tag: noindex, nofollow Content-Security-Policy: default-src 'none'; script-src 'self' 'report-sample'; style-src 'self' 'report-sample'; img-src 'self'; font-src 'self'; frame-src 'self'; frame-ancestors 'none'; form-action 'none'; object-src 'none'; upgrade-insecure-requests ; base-uri 'none'; report-uri https://y-solopsdemo-slms-sql.syndev.dnv.com/csp-reporting-endpoint; report-to csp-reporting-endpoint; X-Permitted-Cross-Domain-Policies: none permissions-policy: accelerometer=(),autoplay=(),camera=(),display-capture=(),encrypted-media=(),fullscreen=(),gamepad=(),geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),picture-in-picture=(),publickey-credentials-get=(),sync-xhr=(self),usb=(),screen-wake-lock=(),web-share=(),xr-spatial-tracking=() Reporting-Endpoints: csp-reporting-endpoint="https://y-solopsdemo-slms-sql.syndev.dnv.com/csp-reporting-endpoint" Page title: Synergi Life - Mobile Service <html><title>Synergi Life - Mobile Service</title></html>